Wellth Consumer Health Data Privacy Notice

Depending on how you use Wellth, the features you use, the devices and services you connect, and the studies or programs you join, we may collect the following categories of consumer health data:

• wearable, fitness, activity, movement, exercise, workout, and training data;
• heart rate, sleep-related data, energy expenditure, calories, distance, pace, route-related data, and similar health, fitness, or bodily-function measurements;
• health-related survey responses, symptom information, wellness information, goals, status updates, and self-reported observations;
• information about participation in health, fitness, research, sponsored, clinical, or wellness programs;
• precise or approximate location information that may indicate participation in a fitness activity, event, study, or health-related service, where collected;
• information that could identify your seeking of or participation in health, wellness, fitness, or research-related services;
• photos, recordings, or uploaded materials that contain health, fitness, or body-related information; and
• inferences drawn from the information above, such as participation patterns, reward eligibility, study completion indicators, or other health- or activity-related insights.

We collect and use consumer health data for the following purposes:

• to provide the products or services you request;
• to connect and sync wearable, fitness, and health-related integrations you choose to enable;
• to verify activity, participation, eligibility, or completion for rewards, incentives, studies, challenges, or sponsored programs;
• to administer payments, rewards, or incentives;
• to support research, sponsored studies, or clinical or partner programs that you choose to join;
• to personalize prompts, opportunities, check-ins, and user experiences;
• to detect and prevent fraud, abuse, duplicate participation, or misuse;
• to secure, maintain, troubleshoot, and improve the Services;
• to conduct internal analytics, testing, product development, and research; and
• to comply with legal obligations and enforce our policies and agreements.

Where required by law, we collect or share consumer health data only with your consent, where necessary to provide a product or service you requested, or as otherwise permitted by law.

We may collect consumer health data from the following categories of sources:

• directly from you;
• from your use of the Services;
• from wearable, fitness, wellness, and health-related services or devices you choose to connect;
• from study sponsors, research sites, clinical partners, or other program partners involved in an experience you choose to join;
• from service providers acting on our behalf; and
• from other sources where you direct us to receive the information or where permitted by law.

Depending on the features you use and the programs you join, we may share the following categories of consumer health data:

• wearable, workout, activity, fitness, sleep, heart rate, and related measurement data;
• health-related survey responses, self-reported information, symptom information, and program submissions;
• participation, eligibility, completion, and reward-related information connected to a study, challenge, or sponsored program;
• limited device, account, or identifier information needed to link records, administer a program, prevent fraud, or fulfill your request; and
• inferences and operational insights derived from the categories above.

We may share consumer health data with the following categories of third parties:

• service providers and processors that host, secure, support, analyze, administer, or operate Wellth on our behalf;
• payment processors and financial service providers when necessary to administer rewards, payouts, reimbursements, or fraud-prevention measures;
• study sponsors, research organizations, institutional partners, contract research organizations, clinical partners, or other business partners involved in a program, study, or experience you choose to join;
• professional advisors such as auditors, lawyers, insurers, and consultants;
• government entities, regulators, and law enforcement where required by law or valid legal process; and
• parties involved in a corporate transaction such as a merger, financing, acquisition, bankruptcy, or asset transfer.

Specific affiliates: Wellth is currently operated by Kyma Neuro, Inc. We do not currently disclose consumer health data to any separate affiliate other than entities under common control that may assist in operating Wellth, if any. If that changes, we will update this Notice as required by law.

We do not disclose consumer health data to advertising platforms, data brokers, or information resellers.

We do not currently sell consumer health data as that term is defined under applicable consumer health data law.

If we ever engage in a transaction that constitutes a sale of consumer health data under applicable law, we will do so only in compliance with applicable law, including obtaining any separate authorization required by law.

If you connect Apple Health or HealthKit, we use that data only to provide the Wellth features, rewards, study, fitness, motion, and related services you request and as described in the applicable consent or authorization for a study or sponsored program you choose to join.

We do not use Apple Health or HealthKit data for advertising, marketing, or unrelated data-mining purposes, and we do not disclose such data to advertising platforms, data brokers, or information resellers.

If you choose to participate in a sponsored study, research program, or partner experience that involves Apple Health or HealthKit data, we may disclose the specific data described in the applicable consent or authorization to the identified sponsor or partner for the purposes described there, as permitted by law.

Depending on the law that applies, you may have the right to:

• confirm whether we are collecting, using, sharing, or selling consumer health data about you;
• access consumer health data we maintain about you;
• receive a list of third parties and affiliates with whom we have shared or sold your consumer health data, where required by law;
• withdraw consent from our future collection or sharing of your consumer health data, subject to legal and operational limitations;
• request deletion of your consumer health data; and
• appeal a refusal to take action on your request, where required by law.

To exercise these rights, please contact us at privacy@kymaneuro.com. We may take steps to verify your identity before processing your request.

If we deny your request, you may appeal by contacting us at privacy@kymaneuro.com with "Privacy Appeal" in the subject line and describing the decision you are appealing.

You may withdraw consent for future collection or sharing of consumer health data by disconnecting connected integrations, changing permissions at the connected platform, closing your account where available, or contacting us using the methods above.

Withdrawal of consent will not affect processing that occurred before the withdrawal became effective, and some information may need to be retained as permitted by law.

We retain consumer health data for as long as reasonably necessary to provide the Services, administer studies, rewards, and sponsored programs, maintain integrity and security, comply with law, resolve disputes, and protect Wellth, our users, and our partners.

Retention periods may vary based on the nature of the data, the program involved, the sensitivity of the data, and our legal or contractual obligations.

We use reasonable administrative, technical, and organizational safeguards designed to protect consumer health data from unauthorized access, misuse, loss, alteration, and disclosure.

We may update this Consumer Health Data Privacy Notice from time to time to reflect changes in the Services, our data practices, or applicable law. When we do, we will revise the "Last updated" date and provide any notice required by law.

If you have questions about this Notice or want to exercise your rights, please contact us at:

Kyma Neuro, Inc.
New York, NY 10016
privacy@kymaneuro.com